IOC Report
build.exe

loading gif

Files

File Path
Type
Category
Malicious
build.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\build.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\build.exe
"C:\Users\user\Desktop\build.exe"
 malicious

URLs

Name
IP
Malicious
78.70.235.238:1912
malicious
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
unknown
https://duckduckgo.com/ac/?q=
unknown
http://tempuri.org/Entity/Id23ResponseD
unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
unknown
http://tempuri.org/Entity/Id12Response
unknown
http://tempuri.org/
unknown
http://tempuri.org/Entity/Id2Response
unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
unknown
http://tempuri.org/Entity/Id21Response
unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
unknown
http://tempuri.org/Entity/Id9
unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
unknown
http://tempuri.org/Entity/Id8
unknown
http://tempuri.org/Entity/Id5
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
unknown
http://tempuri.org/Entity/Id4
unknown
http://tempuri.org/Entity/Id7
unknown
http://purl.oen
unknown
http://tempuri.org/Entity/Id6
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
unknown
http://tempuri.org/Entity/Id19Response
unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat
unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
unknown
http://tempuri.org/Entity/Id15Response
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
unknown
http://tempuri.org/Entity/Id6Response
unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
unknown
https://api.ip.sb/ip
unknown
http://schemas.xmlsoap.org/ws/2004/04/sc
unknown
http://tempuri.org/Entity/Id1ResponseD
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
unknown
http://tempuri.org/Entity/Id9Response
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://tempuri.org/Entity/Id20
unknown
http://tempuri.org/Entity/Id21
unknown
http://tempuri.org/Entity/Id22
unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
unknown
http://tempuri.org/Entity/Id23
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
unknown
http://tempuri.org/Entity/Id24
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
unknown
http://tempuri.org/Entity/Id24Response
unknown
https://www.ecosia.org/newtab/
unknown
http://tempuri.org/Entity/Id1Response
unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
unknown
http://schemas.xmlsoap.org/ws/2004/04/trust
unknown
http://tempuri.org/Entity/Id10
unknown
http://tempuri.org/Entity/Id11
unknown
http://tempuri.org/Entity/Id12
unknown
http://tempuri.org/Entity/Id16Response
unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
unknown
http://tempuri.org/Entity/Id13
unknown
http://tempuri.org/Entity/Id14
unknown
http://tempuri.org/Entity/Id15
unknown
http://tempuri.org/Entity/Id16
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
unknown
http://tempuri.org/Entity/Id17
unknown
http://tempuri.org/Entity/Id18
unknown
http://tempuri.org/Entity/Id5Response
unknown
http://tempuri.org/Entity/Id19
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
unknown
http://tempuri.org/Entity/Id10Response
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
unknown
http://tempuri.org/Entity/Id8Response
unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
unknown
http://schemas.xmlsoap.org/soap/envelope/
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust
unknown
https://duckduckgo.com/chrome_newtabS
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
unknown
http://tempuri.org/Entity/Id3ResponseD
unknown
http://tempuri.org/Entity/Id23Response
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
unknown
There are 90 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
78.70.235.238
unknown
Sweden
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Owner
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
SessionHash
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Sequence
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
RegFiles0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
RegFilesHash

Memdumps

Base Address
Regiontype
Protect
Malicious
1C2000
unkown
page readonly
 malicious
2786000
trusted library allocation
page read and write
 malicious
2ADC000
trusted library allocation
page read and write
50EB000
trusted library allocation
page read and write
C9E000
stack
page read and write
38B7000
trusted library allocation
page read and write
510E000
trusted library allocation
page read and write
72F5000
trusted library allocation
page read and write
2C38000
trusted library allocation
page read and write
5870000
trusted library allocation
page execute and read and write
2B7E000
trusted library allocation
page read and write
5B37000
heap
page read and write
3AC3000
trusted library allocation
page read and write
2BEC000
trusted library allocation
page read and write
29C1000
trusted library allocation
page read and write
3749000
trusted library allocation
page read and write
383B000
trusted library allocation
page read and write
7825000
heap
page read and write
5BA0000
trusted library allocation
page execute and read and write
2B6D000
trusted library allocation
page read and write
7320000
trusted library allocation
page read and write
4C00000
trusted library allocation
page execute and read and write
3AEA000
trusted library allocation
page read and write
2898000
trusted library allocation
page read and write
5B90000
trusted library allocation
page read and write
4BF0000
trusted library allocation
page read and write
29FC000
trusted library allocation
page read and write
4C1A000
trusted library allocation
page read and write
76C0000
heap
page read and write
206000
unkown
page readonly
50F6000
trusted library allocation
page read and write
29BB000
trusted library allocation
page read and write
5BEC000
stack
page read and write
96D000
trusted library allocation
page execute and read and write
2C46000
trusted library allocation
page read and write
5A80000
heap
page read and write
73E000
stack
page read and write
3853000
trusted library allocation
page read and write
2A48000
trusted library allocation
page read and write
2C05000
trusted library allocation
page read and write
26D0000
trusted library allocation
page read and write
7E5000
heap
page read and write
3AA8000
trusted library allocation
page read and write
2A3C000
trusted library allocation
page read and write
79CA000
trusted library allocation
page read and write
4B90000
trusted library allocation
page read and write
3AD1000
trusted library allocation
page read and write
73F0000
trusted library allocation
page read and write
36F1000
trusted library allocation
page read and write
73DE000
stack
page read and write
282F000
trusted library allocation
page read and write
2A77000
trusted library allocation
page read and write
65BD000
stack
page read and write
76D6000
heap
page read and write
78D8000
heap
page read and write
2B09000
trusted library allocation
page read and write
372C000
trusted library allocation
page read and write
B9E000
stack
page read and write
5140000
trusted library allocation
page read and write
4EC0000
trusted library allocation
page read and write
29D7000
trusted library allocation
page read and write
3725000
trusted library allocation
page read and write
283D000
trusted library allocation
page read and write
5920000
trusted library allocation
page execute and read and write
77C0000
heap
page read and write
5120000
trusted library allocation
page read and write
29D9000
trusted library allocation
page read and write
954000
trusted library allocation
page read and write
7CE000
heap
page read and write
9A8000
heap
page read and write
5910000
trusted library allocation
page read and write
3741000
trusted library allocation
page read and write
3754000
trusted library allocation
page read and write
5AED000
heap
page read and write
3767000
trusted library allocation
page read and write
5111000
trusted library allocation
page read and write
388F000
trusted library allocation
page read and write
2AC6000
trusted library allocation
page read and write
2B07000
trusted library allocation
page read and write
77F1000
heap
page read and write
3AB5000
trusted library allocation
page read and write
7310000
trusted library allocation
page read and write
950000
trusted library allocation
page read and write
5150000
trusted library allocation
page execute and read and write
769E000
stack
page read and write
2B13000
trusted library allocation
page read and write
9AE000
heap
page read and write
960000
trusted library allocation
page read and write
2B3A000
trusted library allocation
page read and write
376D000
trusted library allocation
page read and write
29C6000
trusted library allocation
page read and write
4E4E000
stack
page read and write
7BE000
stack
page read and write
2BE4000
trusted library allocation
page read and write
38D8000
trusted library allocation
page read and write
3830000
trusted library allocation
page read and write
5AA8000
heap
page read and write
5B05000
heap
page read and write
4B51000
trusted library allocation
page read and write
8F0000
heap
page read and write
4BD3000
heap
page read and write
5A70000
trusted library allocation
page read and write
29CD000
trusted library allocation
page read and write
38BF000
trusted library allocation
page read and write
789C000
heap
page read and write
5B6F000
heap
page read and write
4EC5000
trusted library allocation
page read and write
7330000
trusted library allocation
page execute and read and write
2A0A000
trusted library allocation
page read and write
4ED0000
heap
page execute and read and write
98B000
trusted library allocation
page execute and read and write
8EE000
stack
page read and write
4BE0000
heap
page read and write
5AF1000
heap
page read and write
5B3D000
heap
page read and write
930000
heap
page read and write
2C8D000
trusted library allocation
page read and write
5A9E000
heap
page read and write
2BA0000
trusted library allocation
page read and write
4B3B000
trusted library allocation
page read and write
2B19000
trusted library allocation
page read and write
5850000
trusted library allocation
page read and write
50F1000
trusted library allocation
page read and write
3AA1000
trusted library allocation
page read and write
3731000
trusted library allocation
page read and write
5B98000
trusted library allocation
page read and write
4C70000
trusted library allocation
page read and write
29D3000
trusted library allocation
page read and write
7E0000
heap
page read and write
4B34000
trusted library allocation
page read and write
3719000
trusted library allocation
page read and write
3876000
trusted library allocation
page read and write
5102000
trusted library allocation
page read and write
2B16000
trusted library allocation
page read and write
6F0000
heap
page read and write
739D000
stack
page read and write
4ECE000
trusted library allocation
page read and write
4B70000
trusted library allocation
page read and write
77C9000
heap
page read and write
3779000
trusted library allocation
page read and write
3847000
trusted library allocation
page read and write
260E000
stack
page read and write
26C0000
trusted library allocation
page read and write
6700000
heap
page read and write
2BE1000
trusted library allocation
page read and write
2869000
trusted library allocation
page read and write
3774000
trusted library allocation
page read and write
3AC9000
trusted library allocation
page read and write
2AA3000
trusted library allocation
page read and write
5130000
trusted library allocation
page read and write
970000
trusted library allocation
page read and write
2500000
heap
page read and write
7C0000
heap
page read and write
2B78000
trusted library allocation
page read and write
7812000
heap
page read and write
4FDF000
stack
page read and write
2BDE000
trusted library allocation
page read and write
7304000
trusted library allocation
page read and write
2619000
trusted library allocation
page read and write
7B0E000
stack
page read and write
2C82000
trusted library allocation
page read and write
29E9000
trusted library allocation
page read and write
4BF2000
trusted library allocation
page read and write
5180000
trusted library allocation
page read and write
2B7C000
trusted library allocation
page read and write
747E000
stack
page read and write
2BF8000
trusted library allocation
page read and write
26CE000
trusted library allocation
page read and write
2ABB000
trusted library allocation
page read and write
2C49000
trusted library allocation
page read and write
7312000
trusted library allocation
page read and write
3AC7000
trusted library allocation
page read and write
4C18000
trusted library allocation
page read and write
29F1000
trusted library allocation
page read and write
5B12000
heap
page read and write
72FF000
trusted library allocation
page read and write
9E7000
heap
page read and write
7430000
trusted library allocation
page execute and read and write
73E0000
trusted library allocation
page read and write
4E70000
heap
page read and write
79C7000
trusted library allocation
page read and write
7ACE000
stack
page read and write
2C73000
trusted library allocation
page read and write
73FC000
trusted library allocation
page read and write
6710000
trusted library allocation
page read and write
3AB9000
trusted library allocation
page read and write
386B000
trusted library allocation
page read and write
5AE7000
heap
page read and write
5AFC000
heap
page read and write
4B56000
trusted library allocation
page read and write
38CA000
trusted library allocation
page read and write
2AB3000
trusted library allocation
page read and write
38A2000
trusted library allocation
page read and write
4C10000
trusted library allocation
page read and write
5E40000
trusted library allocation
page execute and read and write
3884000
trusted library allocation
page read and write
4B62000
trusted library allocation
page read and write
5E2C000
stack
page read and write
64BE000
stack
page read and write
72D2000
trusted library allocation
page read and write
5900000
trusted library allocation
page read and write
4E50000
trusted library allocation
page read and write
985000
trusted library allocation
page execute and read and write
2B21000
trusted library allocation
page read and write
28A8000
trusted library allocation
page read and write
583F000
stack
page read and write
2C43000
trusted library allocation
page read and write
7400000
trusted library allocation
page read and write
5B2B000
heap
page read and write
1C0000
unkown
page readonly
5930000
trusted library allocation
page execute and read and write
37BA000
trusted library allocation
page read and write
72EA000
trusted library allocation
page read and write
3860000
trusted library allocation
page read and write
2C0D000
trusted library allocation
page read and write
5B0E000
heap
page read and write
29E3000
trusted library allocation
page read and write
72D5000
trusted library allocation
page read and write
28F1000
trusted library allocation
page read and write
2840000
trusted library allocation
page read and write
2B92000
trusted library allocation
page read and write
283A000
trusted library allocation
page read and write
3762000
trusted library allocation
page read and write
37EB000
trusted library allocation
page read and write
72E8000
trusted library allocation
page read and write
5860000
trusted library allocation
page read and write
79C0000
trusted library allocation
page read and write
4BD0000
heap
page read and write
67B0000
heap
page read and write
76D1000
heap
page read and write
3A7000
stack
page read and write
4C6E000
stack
page read and write
2B86000
trusted library allocation
page read and write
2C51000
trusted library allocation
page read and write
2C6A000
trusted library allocation
page read and write
9A0000
heap
page read and write
77D4000
heap
page read and write
2B41000
trusted library allocation
page read and write
28CB000
trusted library allocation
page read and write
610000
heap
page read and write
384E000
trusted library allocation
page read and write
24E0000
trusted library allocation
page read and write
2AB0000
trusted library allocation
page read and write
373E000
trusted library allocation
page read and write
5ABA000
heap
page read and write
389B000
trusted library allocation
page read and write
2A4B000
trusted library allocation
page read and write
2A9000
stack
page read and write
2861000
trusted library allocation
page read and write
26F1000
trusted library allocation
page read and write
58D0000
trusted library allocation
page read and write
72FA000
trusted library allocation
page read and write
50E0000
trusted library allocation
page read and write
3835000
trusted library allocation
page read and write
29BE000
trusted library allocation
page read and write
2C93000
trusted library allocation
page read and write
29C9000
trusted library allocation
page read and write
4B4E000
trusted library allocation
page read and write
3780000
trusted library allocation
page read and write
2AA1000
trusted library allocation
page read and write
36FF000
trusted library allocation
page read and write
3AAE000
trusted library allocation
page read and write
2A4E000
trusted library allocation
page read and write
5AC6000
heap
page read and write
3863000
trusted library allocation
page read and write
2A11000
trusted library allocation
page read and write
3842000
trusted library allocation
page read and write
58C0000
trusted library allocation
page execute and read and write
940000
trusted library allocation
page read and write
7838000
heap
page read and write
2B2C000
trusted library allocation
page read and write
95D000
trusted library allocation
page execute and read and write
78DB000
heap
page read and write
5D2E000
stack
page read and write
511A000
trusted library allocation
page read and write
976000
trusted library allocation
page execute and read and write
3720000
trusted library allocation
page read and write
373B000
trusted library allocation
page read and write
5B23000
heap
page read and write
58F0000
trusted library allocation
page execute and read and write
72D0000
trusted library allocation
page read and write
982000
trusted library allocation
page read and write
38B4000
trusted library allocation
page read and write
5B47000
heap
page read and write
29E6000
trusted library allocation
page read and write
4ECB000
trusted library allocation
page read and write
5B1D000
heap
page read and write
2C5C000
trusted library allocation
page read and write
50DE000
stack
page read and write
3792000
trusted library allocation
page read and write
4EBE000
stack
page read and write
3ADD000
trusted library allocation
page read and write
97A000
trusted library allocation
page execute and read and write
7F5B0000
trusted library allocation
page execute and read and write
77E1000
heap
page read and write
26E0000
heap
page execute and read and write
58E0000
trusted library allocation
page read and write
72EF000
trusted library allocation
page read and write
690E000
stack
page read and write
2802000
trusted library allocation
page read and write
26D5000
trusted library allocation
page read and write
71C0000
heap
page read and write
953000
trusted library allocation
page execute and read and write
5840000
trusted library allocation
page read and write
2A3E000
trusted library allocation
page read and write
77FC000
heap
page read and write
1F7000
unkown
page readonly
38F3000
trusted library allocation
page read and write
26B0000
trusted library allocation
page read and write
77E000
stack
page read and write
7C6000
heap
page read and write
72D9000
trusted library allocation
page read and write
7315000
trusted library allocation
page read and write
248E000
stack
page read and write
4E61000
trusted library allocation
page read and write
385D000
trusted library allocation
page read and write
3896000
trusted library allocation
page read and write
987000
trusted library allocation
page execute and read and write
5CEC000
stack
page read and write
5B17000
heap
page read and write
2440000
trusted library allocation
page read and write
65FB000
stack
page read and write
7300000
trusted library allocation
page read and write
2AD4000
trusted library allocation
page read and write
3AEF000
trusted library allocation
page read and write
24CB000
stack
page read and write
4C15000
trusted library allocation
page read and write
2A6F000
trusted library allocation
page read and write
972000
trusted library allocation
page read and write
1F2000
unkown
page readonly
5A8D000
heap
page read and write
4B30000
trusted library allocation
page read and write
5E50000
trusted library allocation
page read and write
24F0000
trusted library allocation
page read and write
66FE000
stack
page read and write
980000
trusted library allocation
page read and write
3889000
trusted library allocation
page read and write
38A7000
trusted library allocation
page read and write
4B5D000
trusted library allocation
page read and write
9D5000
heap
page read and write
24D0000
trusted library allocation
page execute and read and write
2BA7000
trusted library allocation
page read and write
2AAD000
trusted library allocation
page read and write
47EC000
stack
page read and write
680E000
stack
page read and write
2854000
trusted library allocation
page read and write
2A56000
trusted library allocation
page read and write
2BD3000
trusted library allocation
page read and write
9E4000
heap
page read and write
71D0000
heap
page read and write
3711000
trusted library allocation
page read and write
38B1000
trusted library allocation
page read and write
2A61000
trusted library allocation
page read and write
2848000
trusted library allocation
page read and write
5B73000
heap
page read and write
There are 345 hidden memdumps, click here to show them.